CVE-2026-32010: OpenClaw safeBins bypass enables

CISO Take

OpenClaw's tool execution allowlist (safeBins) can be subverted by invoking `sort` — if it's been added to safeBins — with the `--compress-program` flag, causing it to silently spawn any external binary without triggering the mandatory operator approval flow. Despite requiring local access and high attack complexity, EPSS places this in the top 80th percentile for exploitation likelihood; in agentic deployments where prompt injection could drive tool invocation, the effective attack surface expands significantly. The 396 prior CVEs against this same package signal systemic security debt warranting heightened scrutiny beyond this single issue. Patch immediately to OpenClaw 2026.2.22 or remove `sort` from `tools.exec.safeBins` as an interim workaround, and audit all other safeBins entries for similar exec-delegation flag patterns.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS but elevated concern in AI agent deployments. The local attack vector and high complexity limit opportunistic exploitation, but the vulnerability directly breaks the security invariant that operator approval gates all unapproved tool executions. In agentic or computer-use environments, a prompt injection vector can substitute for direct local access, effectively lowering the real-world complexity. The package's 396-CVE history and 4 downstream dependents add systemic risk context that the CVSS score alone understates.

How does the attack unfold?

Initial Access

Attacker gains low-privilege local access to a host running OpenClaw, or achieves indirect access via prompt injection into the agent's input pipeline from a poisoned data source.

AML.T0051

Allowlist Bypass

Attacker invokes sort with --compress-program=<malicious_binary> through the agent's tool execution interface, exploiting the flag to redirect execution to an arbitrary external program without triggering the operator approval prompt.

AML.T0107

Arbitrary Code Execution

The malicious binary runs under OpenClaw's process privileges, executing attacker-controlled code silently outside any approval gate or audit trail.

AML.T0053

Impact

Attacker achieves data exfiltration, persistence mechanism installation, or lateral movement from the AI agent host, compromising system integrity and availability.

AML.T0105

Initial Access

Attacker gains low-privilege local access to a host running OpenClaw, or achieves indirect access via prompt injection into the agent's input pipeline from a poisoned data source.

AML.T0051

Allowlist Bypass

Attacker invokes sort with --compress-program=<malicious_binary> through the agent's tool execution interface, exploiting the flag to redirect execution to an arbitrary external program without triggering the operator approval prompt.

AML.T0107

Arbitrary Code Execution

The malicious binary runs under OpenClaw's process privileges, executing attacker-controlled code silently outside any approval gate or audit trail.

AML.T0053

Impact

Attacker achieves data exfiltration, persistence mechanism installation, or lateral movement from the AI agent host, compromising system integrity and availability.

AML.T0105

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch: Upgrade to OpenClaw 2026.2.22 or later (patch commit 57fbbaebca4d).
Immediate workaround: Remove sort from tools.exec.safeBins.
Audit: Review all other entries in safeBins for binaries that accept exec-delegation flags — candidates include xz, gzip, zip, tar, zstd, and bzip2, which all support --use-compress-program or equivalent.
Harden: Prefer strict deny mode over ask=on-miss where operational requirements permit; on-miss widens the allowlist attack surface.
Detect: Alert on unexpected child processes spawned by the OpenClaw process, particularly short-lived processes not matching known safeBins entries.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2.5 - AI system security controls

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to AI risks

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32010?

OpenClaw's tool execution allowlist (safeBins) can be subverted by invoking `sort` — if it's been added to safeBins — with the `--compress-program` flag, causing it to silently spawn any external binary without triggering the mandatory operator approval flow. Despite requiring local access and high attack complexity, EPSS places this in the top 80th percentile for exploitation likelihood; in agentic deployments where prompt injection could drive tool invocation, the effective attack surface expands significantly. The 396 prior CVEs against this same package signal systemic security debt warranting heightened scrutiny beyond this single issue. Patch immediately to OpenClaw 2026.2.22 or remove `sort` from `tools.exec.safeBins` as an interim workaround, and audit all other safeBins entries for similar exec-delegation flag patterns.

Is CVE-2026-32010 actively exploited?

No confirmed active exploitation of CVE-2026-32010 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32010?

1. Patch: Upgrade to OpenClaw 2026.2.22 or later (patch commit 57fbbaebca4d). 2. Immediate workaround: Remove `sort` from `tools.exec.safeBins`. 3. Audit: Review all other entries in safeBins for binaries that accept exec-delegation flags — candidates include `xz`, `gzip`, `zip`, `tar`, `zstd`, and `bzip2`, which all support `--use-compress-program` or equivalent. 4. Harden: Prefer strict deny mode over `ask=on-miss` where operational requirements permit; `on-miss` widens the allowlist attack surface. 5. Detect: Alert on unexpected child processes spawned by the OpenClaw process, particularly short-lived processes not matching known safeBins entries.

What systems are affected by CVE-2026-32010?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, AI orchestration pipelines, computer-use AI agents.

What is the CVSS score for CVE-2026-32010?

CVE-2026-32010 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsAI orchestration pipelinescomputer-use AI agents

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin configuration when sort is manually added to tools.exec.safeBins. Attackers can invoke sort with the --compress-program flag to execute arbitrary external programs without operator approval in allowlist mode with ask=on-miss enabled.

Exploitation Scenario

An adversary with low-privilege local access — or an attacker who has achieved prompt injection into the agent's context — crafts a tool invocation passing `sort --compress-program=/tmp/implant /dev/null`. Because `sort` is on the safeBins allowlist, OpenClaw approves execution under `ask=on-miss` without presenting an operator confirmation prompt. The `sort` binary forks the `--compress-program` target with the OpenClaw process's privileges, executing the implant silently. In a CI/CD or agentic AI pipeline, this chain can be triggered remotely via a poisoned data source that the agent processes, converting a medium-severity local CVE into a remote code execution scenario when combined with indirect prompt injection.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.